See your network. Then decide what it may do.
Kanata puts a small agent on every server, draws what they actually talk to, and manages the host firewalls from that same picture. One place to find out what is really connecting to what — and to change it, zone by zone, without logging into a single box.
Every conversation on the estate, drawn from what the servers themselves report
This is the real renderer from the console, with a demonstration fleet behind it. Drag it, zoom it, click a server to see only what touches it, or hover a line to see both directions of the conversation. Lines are weighted by how busy they have been, so where the traffic is takes no reading at all.
Direction, not just adjacency
A relationship is directed. One line carries an arrow at each end, coloured by the direction arriving there, so a database being queried never looks like one calling out.
Busy, and busy for how long
Conversations are counted and their time in use measured, so a session somebody has held open all afternoon is not drawn as the quietest path on the map.
Reachable, and whether anything explains it
A path that works but no rule accounts for is coloured differently from one that works because you said it should. That difference is usually the interesting one.
The state of the estate, on one screen
Which servers are reporting, which have drifted from their policy, and how much is actually moving across the network right now.
| Policy deployed 13 servers instructed |
4m |
| app-03 applied policy on its own, not from a deploy |
11m |
| file-01 stopped checking in | 2d |
| Rule added Block RDP from anywhere but management |
3d |
Open any server and see what it is, what it talks to, and what applies to it
Pick one. Everything here comes from what that server reported about itself — Kanata never has to connect inbound to ask.
Write the rule once, between zones. Kanata works out which servers it touches.
Rules are written between zones, not hosts, so adding a server to a zone gives it the policy of that zone and nothing else changes. Switch a rule off below and watch the deployment preview work out who is affected.
Before it goes out
Audit first
A server in audit mode reports the difference between what it has and what policy says, and changes nothing. Read the differences before you enforce anything.
It undoes itself
In enforce mode the previous rules are saved before a change. If the console stays unreachable through the rollback window, the server puts them back without being asked.
It only touches its own rules
Everything Kanata creates is named or filed under its own table. Whatever else is on the host — your own rules, an installer's, the platform's — is read and then left alone.
A map of your network is exactly the thing you should not be uploading
Kanata runs on one machine of yours. There is no account to create, no tenant, no telemetry, and no address anywhere in it that points at us.
Outbound only
Agents dial the console over HTTPS and collect their work. No managed server needs an inbound port opened — which would be an odd way to start, for a tool that manages firewalls.
Signed per host
Each agent generates its own key at enrolment and the private half never leaves the machine. Nothing else on your network can report as that server.
Pinned in transit
Pin the console certificate at install and an intercepting proxy cannot read or alter a single report, however the network between them is arranged.
One binary, one database
A single Go binary with the interface compiled in and SQLite underneath. Back up one directory and you have backed up the installation.
Run the console
One container. It generates its own certificate and prints the pin and a first-run password to the log.
Enrol a server
Copy the command the console shows you. The agent installs its own service and starts reporting.
Watch, then enforce
Leave everything in audit mode until the map looks like your network. Then move one server to enforce.
Every server you have. Two ways to pay for it.
There is no server tier to size and no seat count to negotiate. The only decision is whether you would rather rent it or own it.
The whole product, renewed annually. Stop whenever it stops being worth it — what you have already mapped stays yours.
Bought once and yours permanently, on your own hardware, with no licence server to phone home to and nothing to renew.
Find out what your servers are actually doing
Put it on one machine, enrol a handful of servers, and leave it in audit mode for a week. The map alone is usually worth the afternoon.